The Guardian, in collaboration with the University of Cambridge Department of Computer Science, launches open-source Secure Messaging

Built by our product and engineering team, in partnership with the University of Cambridge’s department of computer science ​and technology​, Secure Messaging is unlike traditional information-sharing platforms​. The technology behind Secure Messaging conceals the fact that messaging is taking place at all by making the communication indistinguishable from other data sent to and from the app by our millions of regular users. By using the Guardian app, other users are effectively providing “cover” and helping us to protect sources.

Secure Messaging is not just a tool for the Guardian. As part of our commitment to protecting the media and the public interest globally, the Guardian has published the source code for the technology that enables this system. This means that other organisations will be able to use this technology freely to implement secure messaging tools within their own apps.

This is their comment about how it compares to Signal:

End-to-end encrypted (E2EE) messaging apps like Signal and WhatsApp provide strong confidentiality of the message content. However, they do not hide communication patterns, such as who is communicating with whom and when. In addition, users cannot plausibly deny the existence of conversations if they are forced to unlock their smartphone. CoverDrop provides both strong metadata privacy, hiding who is communicating with whom and when, and plausible deniability, even where an adversary has physical access to the device and asks the user to unlock it.

I thought when Signal added sealed sender it was to make it hard to analyze traffic patterns on the server side. Signal would make it harder to deny communicating with someone if your phone is unlocked as even conversations with disappearing messages don't disappear themselves as I recall.

I am all for more secure communication, but in my mind, anything in this space needs to demonstrate how it's fundamentally better than signal. For the general use case that's typically pretty hard.